Listen to this Post
The vulnerability arises when dynamic cookies are enabled in an Elysia application, meaning a cookie schema is defined for a route. The cookie configuration, including values like secrets, is directly injected into the compiled route code during the ahead-of-time (AOT) compilation process without proper sanitization. This injection occurs because the configuration values are embedded using template literals, allowing JavaScript code within them to be executed. An attacker who can control the cookie configuration—for instance, by manipulating environment variables that supply the config—can inject arbitrary code. This injected code is then executed when the route is compiled, leading to remote code execution (RCE) on the server. The exploit requires specific conditions: AOT compilation must be enabled (which is default), a cookie schema must be passed to the route, and the cookie config must be controllable, often via unsanitized environment variables. The vulnerability’s availability is typically low as it needs write access to the app’s source or config, but when chained with other weaknesses like GHSA-hxj9-33pp-j2cc, it becomes a full RCE threat.
Platform: Elysia
Version: <1.4.17
Vulnerability: Arbitrary Code Execution
Severity: Critical
Date: 2024-03-20
Prediction: Patched 2024-03-20
What Undercode Say:
Analytics
git clone https://github.com/sportshead/elysia-poc
cd elysia-poc
npm install
node poc.js
curl http://localhost:3000/
How Exploit:
Control cookie config.
Inject malicious JavaScript.
Trigger route compilation.
Protection from this CVE
Update to 1.4.17.
Sanitize env inputs.
Use overrideUnsafeQuote.
Impact:
Remote Code Execution.
Server compromise.
Data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
